# Mohammad Meraj

- **URL:** https://hackindex.io/authors/mohammad-meraj
- **Role:** Independent Security Researcher
- **Profiles:** https://github.com/Meraj1312, https://discordapp.com/users/1435274444925833226, https://www.linkedin.com/in/mohammad-meraj-9b5952425

## Writeups

- [Ten Writeup - HackTheBox](https://hackindex.io/writeups/ten.md): Exploiting a Node.js app via prototype pollution and SSRF to gain RCE, then escalating privileges through a misconfigured service on a Hard Linux HTB box.
- [Silo Writeup - HackTheBox](https://hackindex.io/writeups/silo.md): Exploit Oracle DB on Windows via ODAT for RCE, upload a web shell, then leverage Oracle SYSDBA privileges to escalate and retrieve flags.
- [Horizontall Writeup - HackTheBox](https://hackindex.io/writeups/horizontall.md): Exploit Strapi CMS RCE on a subdomain, gain shell, then pivot via SSH tunneling to attack a local Laravel app for root.
- [Conceal Writeup - HackTheBox](https://hackindex.io/writeups/conceal.md): IKE/IPSec enumeration to establish VPN tunnel, then exploiting FTP upload to IIS webroot for RCE via ASP shell, escalating via SeImpersonatePrivilege.
- [Love Writeup - HackTheBox](https://hackindex.io/writeups/love.md): Exploited a Windows machine via SSRF to leak VOTD app credentials, then used a file upload shell to gain access and abused AlwaysInstallElevated for privesc.
- [Frolic Writeup - HackTheBox](https://hackindex.io/writeups/frolic.md): Exploit a PlaySMS RCE vulnerability after decoding OOK/Brainfuck/Base64 creds, then escalate via SUID rop binary with ret2libc.
- [Legacy Writeup - HackTheBox](https://hackindex.io/writeups/legacy.md): Exploiting MS08-067 and MS17-010 vulnerabilities on an unpatched Windows XP machine to gain SYSTEM-level access without user interaction.
- [Ophiuchi Writeup - HackTheBox](https://hackindex.io/writeups/ophiuchi.md): YAML deserialization flaw exploited via SnakeYAML to gain foothold, then abusing WASM/bash script path hijacking for privilege escalation on Linux.
- [OpenAdmin Writeup - HackTheBox](https://hackindex.io/writeups/openadmin.md): Exploit OpenNetAdmin RCE to gain initial access, pivot through internal web configs for credentials, then escalate via nano GTFOBins sudo misconfiguration.
- [Anubis Writeup - HackTheBox](https://hackindex.io/writeups/anubis.md): Insane Windows box involving SSRF, certificate services abuse, ADCS ESC1, and Shadow Credentials to escalate through Active Directory.
- [FriendZone Writeup - HackTheBox](https://hackindex.io/writeups/friendzone.md): SMB enumeration reveals credentials and DNS zones. Exploiting LFI with PHP injection leads to a shell, then Python library hijacking for root.
- [Chatterbox Writeup - HackTheBox](https://hackindex.io/writeups/chatterbox.md): Windows box exploiting Achat buffer overflow for initial foothold, then abusing weak file permissions and stored credentials for privilege escalation.
- [Delivery Writeup - HackTheBox](https://hackindex.io/writeups/delivery.md): Exploit an open MatterMost server and helpdesk ticket email trick to gain internal credentials, then crack a bcrypt hash using custom rules for root.
- [Mango Writeup - HackTheBox](https://hackindex.io/writeups/mango.md): Linux box exploiting NoSQL injection to bypass MongoDB login, SSH with harvested credentials, then privilege escalation via SUID jjs binary.
- [Doctor Writeup - HackTheBox](https://hackindex.io/writeups/doctor.md): Exploit SSTI in Doctor's messaging app via log poisoning, gain RCE as web user, then escalate via Splunk Universal Forwarder credentials.
- [APT Writeup - HackTheBox](https://hackindex.io/writeups/apt.md): Insane Windows box involving IPv6 enumeration, RPC abuse, dumping AD secrets via NTDS, and leveraging historical credential reuse to gain SYSTEM.
- [Blocky Writeup - HackTheBox](https://hackindex.io/writeups/blocky.md): Exploit a Minecraft server's exposed plugin JAR containing hardcoded credentials to gain SSH access and escalate to root via sudo misconfiguration.
- [Bastard Writeup - HackTheBox](https://hackindex.io/writeups/bastard.md): Windows machine exploited via Drupal RCE (CVE-2018-7600), followed by privilege escalation using MS15-051 kernel exploit to gain SYSTEM access.
- [Bank Writeup - HackTheBox](https://hackindex.io/writeups/bank.md): Exploit SQL injection and LFI on a Linux web server, upload a malicious file for RCE, then escalate privileges to root via SUID binary abuse.
- [SecNotes Writeup - HackTheBox](https://hackindex.io/writeups/secnotes.md): Exploit second-order SQLi to steal credentials, abuse a SMB share to upload a PHP webshell, then escape WSL to escalate to SYSTEM.
- [Beep Writeup - HackTheBox](https://hackindex.io/writeups/beep.md): Exploit LFI via Elastix/FreePBX to leak credentials, then SSH as root using default voip creds or shellshock for easy pwn.
- [Bounty Writeup - HackTheBox](https://hackindex.io/writeups/bounty.md): Windows IIS box exploited via malicious web.config upload for RCE, then escalated to SYSTEM using token impersonation with Metasploit.
- [Devel Writeup - HackTheBox](https://hackindex.io/writeups/devel.md): Exploit anonymous FTP write access on IIS to upload an ASPX web shell, then escalate privileges via MS11-046 kernel exploit on Windows.
- [Pit Writeup - HackTheBox](https://hackindex.io/writeups/pit.md): SNMP enumeration reveals hidden vhosts and CockpitCMS credentials. Exploits lead to RCE via file upload, then SNMP-triggered script for root.
- [Jerry Writeup - HackTheBox](https://hackindex.io/writeups/jerry.md): Exploit default Tomcat credentials to upload a malicious WAR file, gaining a shell as SYSTEM on this beginner-friendly Windows machine.
- [Armageddon Writeup - HackTheBox](https://hackindex.io/writeups/armageddon.md): Exploit Drupalgeddon2 RCE on a Drupal site, crack harvested MySQL creds, then abuse dirty_sock via snap for root escalation.
- [Intelligence Writeup - HackTheBox](https://hackindex.io/writeups/intelligence.md): Active Directory box involving PDF metadata extraction, LDAP enumeration, DNS poisoning, and Kerberos abuse to escalate privileges on a Windows domain.
- [Object Writeup - HackTheBox](https://hackindex.io/writeups/object.md): Exploit Jenkins via firewall bypass, extract credentials, abuse Active Directory delegation and ACL misconfigurations to escalate privileges on Windows.
- [Brainfuck Writeup - HackTheBox](https://hackindex.io/writeups/brainfuck.md): Insane Linux box involving RSA key exploitation, SMTP enumeration, WordPress vulnerabilities, and complex privilege escalation techniques.
- [Blackfield Writeup - HackTheBox](https://hackindex.io/writeups/blackfield.md): Active Directory exploitation via AS-REP roasting, SMB enumeration, BloodHound analysis, ForceChangePassword abuse, and SeBackupPrivilege for NTDS.dit extraction.
- [Jarvis Writeup - HackTheBox](https://hackindex.io/writeups/jarvis.md): SQL injection on hotel booking site leads to RCE via SQLMap's file write. Escalate through command injection in a script and sudo abuse of systemctl.
- [Magic Writeup - HackTheBox](https://hackindex.io/writeups/magic.md): SQL injection auth bypass, webshell upload via image magic bytes, mysqldump credential harvesting, and suid binary PATH hijack for root.
- [DarkZero Writeup - HackTheBox](https://hackindex.io/writeups/darkzero.md): Hard Windows box involving advanced exploitation techniques, privilege escalation, and lateral movement through a complex Windows environment.